CVE-2024-58382

league/commonmark, a widely used PHP Markdown parsing library, contains polynomial time complexity flaws (CWE-407) in its Markdown parser that let crafted input drive parsing cost toward worst-case performance. An attacker who can submit Markdown that the application then parses — via comment forms, CMS content fields, or APIs that render user Markdown — can trigger this with unauthenticated network requests (CVSS 4.0: AV:N/PR:N/UI:N, availability-only impact). By sending multiple crafted requests in parallel, the attacker can exhaust CPU resources and the PHP-FPM worker pool, causing denial of service for the host application. All applications bundling any league/commonmark release before 2.6.0 that parse attacker-controlled Markdown are affected, including where the library is a transitive dependency. There is no CISA KEV entry and no known public proof-of-concept, and exploitation has not been observed in the wild.

What to do: Upgrade league/commonmark to 2.6.0 or later, checking composer.lock and the full dependency tree since it is frequently pulled in transitively rather than declared directly. Until patched, length-limit or restrict untrusted Markdown input and rate-limit or cap concurrent parse-heavy requests to protect the PHP-FPM worker pool. Prioritize reviewing internet-facing endpoints that render user-supplied Markdown, as no in-the-wild exploitation has yet been reported.